Support resource-level IAM grants

### TL;DR

Currently only org, folder, and project are accepted for resource. It would be nice if any resource could be supported. I'm not sure of the viability, but seems worth looking into to ensure least privilege.

https://github.com/abcxyz/access-on-demand/blob/5792d1bb468881d405ab0683fbef5b9229d5cbd1/pkg/handler/iam_handler.go#L48C22-L48C31

### Detailed design

```markdown

```

### Alternatives considered

```markdown

```

### Additional information

_No response_

The issue points to pkg/handler/iam_handler.go line 48, where resource-level IAM grants are currently limited. Start by examining the IAM handler's logic and the Google Cloud IAM API to understand how to extend support to arbitrary resources. Look for existing tests around IAM handling to see the current validation and expansion patterns. Determine what changes are needed to accept and process a broader set of resource types while maintaining security and least privilege.

索引モデルが issue の本文から書いたものです。